Security Audit Report: Tempo Protocol

// Check if key has expired
if (block.timestamp >= key.expiry) {
    revert KeyExpired();
}

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.28 <0.9.0;

import "forge-std/Test.sol";
import "src/AccountKeychain.sol";

contract AccountKeychainHarness is AccountKeychain {
    function setTransactionKey(address keyId) external {
        _setTransactionKey(keyId);
    }

    function verifyAndUpdateSpending(address account, address keyId, address token, uint256 amount)
        external
    {
        _verifyAndUpdateSpending(account, keyId, token, amount);
    }
}

contract ExpiredKeySpendingTest is Test {
    AccountKeychainHarness keychain;

    function setUp() public {
        keychain = new AccountKeychainHarness();
    }

    function test_expired_key_can_still_spend() public {
        address keyId = address(0xBEEF);
        address token = address(0xCAFE);

        IAccountKeychain.TokenLimit[] memory limits = new IAccountKeychain.TokenLimit[](1);
        limits[0] = IAccountKeychain.TokenLimit({token: token, amount: 100});

        // authorize key with short expiry
        keychain.authorizeKey(
            keyId,
            IAccountKeychain.SignatureType.Secp256k1,
            uint64(block.timestamp + 1),
            true,
            limits
        );

        // move time past expiry
        vm.warp(block.timestamp + 2);

        // Protocol-level spending check should fail for expired keys,
        // but it succeeds because expiry is never checked.
        keychain.verifyAndUpdateSpending(address(this), keyId, token, 10);

        // Remaining limit reduced, proving spending succeeded after expiry.
        uint256 remaining = keychain.getRemainingLimit(address(this), keyId, token);
        assertEq(remaining, 90);
    }
}

--- src/AccountKeychain.sol
+++ src/AccountKeychain.sol
@@ -269,6 +269,11 @@
             revert KeyNotFound();
         }

+        // Check if key has expired
+        if (block.timestamp >= key.expiry) {
+            revert KeyExpired();
+        }
+
         // If enforceLimits is false, this key has unlimited spending
         if (!key.enforceLimits) {
             return;

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;

import "forge-std/Test.sol";
import "src/ValidatorConfig.sol";
import "src/interfaces/IValidatorConfig.sol";

contract ValidatorStatusFrontRunTest is Test {
    ValidatorConfig config;

    address admin = address(0xA11CE);
    address validator1 = address(0xB0B);
    address validator2 = address(0xC0C);

    function setUp() public {
        config = new ValidatorConfig(admin);

        vm.prank(admin);
        config.addValidator(
            validator1,
            bytes32(uint256(1)),
            true,
            "host:1234",
            "1.2.3.4:1234"
        );
    }

    function testValidatorCanEvadeDeactivationByRotatingAddress() public {
        // Validator front-runs by rotating to a new address
        vm.prank(validator1);
        config.updateValidator(
            validator2,
            bytes32(uint256(2)),
            "host:1234",
            "1.2.3.4:1234"
        );

        // Admin attempts to deactivate old address, but it no longer exists
        vm.prank(admin);
        vm.expectRevert(IValidatorConfig.ValidatorNotFound.selector);
        config.changeValidatorStatus(validator1, false);

        // Validator remains active at the new address
        (, bool active, , , , ) = config.validators(validator2);
        assertTrue(active, "validator should remain active after rotation");
    }
}

--- src/ValidatorConfig.sol
+++ src/ValidatorConfig.sol
@@ -20,6 +20,9 @@

     /// @notice Mapping from validator address to validator info
     mapping(address => Validator) public validators;
+
+    /// @notice Mapping from current or historical validator address to validator index + 1
+    mapping(address => uint256) private validatorIndexByAddress;

     /// @notice The epoch at which a fresh DKG ceremony will be triggered
     uint64 private nextDkgCeremony;
@@ -82,6 +85,9 @@
             outboundAddress: outboundAddress
         });

+        // Track the validator index for address lookups
+        validatorIndexByAddress[newValidatorAddress] = uint256(validatorCount) + 1;
+
         // Add to array
         validatorsArray.push(newValidatorAddress);

@@ -127,6 +133,9 @@
         _validateHostPort(inboundAddress, "inboundAddress");
         _validateIpPort(outboundAddress, "outboundAddress");

+        // Track the validator index for address lookups
+        validatorIndexByAddress[newValidatorAddress] = uint256(oldValidator.index) + 1;
+
         // Store updated validator
         validators[newValidatorAddress] = Validator({
             publicKey: publicKey,
@@ -142,7 +151,23 @@
     function changeValidatorStatus(address validator, bool active) external onlyOwner {
         // Check if validator exists
         if (validators[validator].publicKey == bytes32(0)) {
-            revert ValidatorNotFound();
+            uint256 indexPlusOne = validatorIndexByAddress[validator];
+            if (indexPlusOne == 0) {
+                revert ValidatorNotFound();
+            }
+
+            uint64 index = uint64(indexPlusOne - 1);
+            if (index >= validatorsArray.length) {
+                revert ValidatorNotFound();
+            }
+
+            address validatorAddress = validatorsArray[index];
+            if (validators[validatorAddress].publicKey == bytes32(0)) {
+                revert ValidatorNotFound();
+            }
+
+            validators[validatorAddress].active = active;
+            return;
         }

         validators[validator].active = active;